Received-SPF: pass (google.com: domain of linux-kernel+bounces-43202-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Precedence: bulk
MIME-Version: 1.0
References: <20240127234636.609265-1-neelnatu@google.com> <2024012727-petition-flip-917c@gregkh>
In-Reply-To: <2024012727-petition-flip-917c@gregkh>
From: Neel Natu <neelnatu@google.com>
Date: Mon, 29 Jan 2024 09:33:02 -0800
Message-ID: <CAJDe-OJoxh5V=fLqeRF+F09e023oMX1ikZb3kC7R=rrKKA1uAg@mail.gmail.com>
Subject: Re: [PATCH] kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Tejun Heo <tj@kernel.org>, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

On Sat, Jan 27, 2024 at 4:02=E2=80=AFPM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Sat, Jan 27, 2024 at 03:46:36PM -0800, Neel Natu wrote:
> > Prior to this change 'on->nr_mmapped' tracked the total number of
> > mmaps across all of its associated open files via kernfs_fop_mmap().
> > Thus if the file descriptor associated with a kernfs_open_file was
> > mmapped 10 times then we would have: 'of->mmapped =3D true' and
> > 'of_on(of)->nr_mmapped =3D 10'.
> >
> > The problem is that closing or draining a 'of->mmapped' file would
> > only decrement one from the 'of_on(of)->nr_mmapped' counter.
> >
> > For e.g. we have this from kernfs_unlink_open_file():
> >         if (of->mmapped)
> >                 on->nr_mmapped--;
> >
> > The WARN_ON_ONCE(on->nr_mmapped) in kernfs_drain_open_files() is
> > easy to reproduce by:
> > 1. opening a (mmap-able) kernfs file.
> > 2. mmap-ing that file more than once (mapping just once masks the issue=
).
> > 3. trigger a drain of that kernfs file.
> >
> > Modulo out-of-tree patches I was able to trigger this reliably by
> > identifying pci device nodes in sysfs that have resource regions
> > that are mmap-able and that don't have any driver attached to them
> > (steps 1 and 2). For step 3 we can "echo 1 > remove" to trigger a
> > kernfs_drain.
> >
> > Signed-off-by: Neel Natu <neelnatu@google.com>
> > ---
> >  fs/kernfs/file.c | 8 +++++---
> >  1 file changed, 5 insertions(+), 3 deletions(-)
> >
> > diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
> > index ffa4565c275a..e9df2f87072c 100644
> > --- a/fs/kernfs/file.c
> > +++ b/fs/kernfs/file.c
> > @@ -483,9 +483,11 @@ static int kernfs_fop_mmap(struct file *file, stru=
ct vm_area_struct *vma)
> >               goto out_put;
> >
> >       rc =3D 0;
> > -     of->mmapped =3D true;
> > -     of_on(of)->nr_mmapped++;
> > -     of->vm_ops =3D vma->vm_ops;
> > +     if (!of->mmapped) {
> > +             of->mmapped =3D true;
> > +             of_on(of)->nr_mmapped++;
> > +             of->vm_ops =3D vma->vm_ops;
> > +     }
> >       vma->vm_ops =3D &kernfs_vm_ops;
> >  out_put:
> >       kernfs_put_active(of->kn);
>
> What commit id does this fix?

bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72
kernfs: Skip kernfs_drain_open_files() more aggressively

best
Neel

>
> thanks,
>
> greg k-h